CVE-2026-92951

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.98 packages and security update

Red Hat OpenShift Container Platform release 4.12.98 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

CVE-2026-54339: Server-Side Request Forgery (SSRF)

Glean is a self-hosted RSS reader and personal knowledge management tool. Prior to 0.2.6, POST /api/feeds/discover passes an attacker-supplied feedurl to discoverfeedfeedurl, creates a subscription through FeedService.createsubscription, and enqueues fetchfeedtask. The background path calls...

CVE-2026-54253: Improper Neutralization of Input During Web Page Generation

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

GO-2026-6441 vulnerabilities

Vulnerabilities for packages: tempo, secrets-store-csi-driver-provider-azure, opentofu, k8ssandra-client, cilium, datadog-agent-fips, mcp-grafana-fips, tekton-pipelines, crossplane-provider-aws-codestarnotifications-fips, elastic-agent, amazon-ssm-agent-fips, commercial-nginx-ingress,...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: cerbos-fips, nvidia-container-toolkit, flux-source-controller, terraform, kserve-localmodelnode-agent-fips, k8s-agents-operator, dex, newrelic-infrastructure-agent-fips, spegel, argo-workflows-fips, crossplane-provider-aws-efs, crossplane-provider-aws-workspaces-fips...

GO-2026-6348 vulnerabilities

Vulnerabilities for packages: trivy-operator, opentelemetry-operator, undock, fuse-overlayfs-snapshotter, kwok, sftpgo, terraform-provider-azurerm, velero-plugin-for-microsoft-azure, falcoctl, witness, dkron, step-kms-plugin, argocd-image-updater, mcp-grafana, kube-vip, tekton-pipelines,...

CLSA-2026-1789577899 TuxCare security update for 10 packages (1 CVE)

TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 3.1.2.RELEASE-tuxcare.2...

CVE-2026-88059 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

CVE-2026-85706 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gitlab-runner, gitlab-runner-fips, gitlab-workhorse-ce-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce, gitlab-pages...

CVE-2026-78126 vulnerabilities

Vulnerabilities for packages: strongswan...

CVE-2026-54490 vulnerabilities

Vulnerabilities for packages: argo-workflows...

CVE-2026-59887 vulnerabilities

Vulnerabilities for packages: argo-workflows...

PT-2026-93327

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 13.9 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An authenticated user with developer-role permissions can substitute package file content and hide packag...

CLSA-2026-1789478968 TuxCare security update for 11 packages (1 CVE)

TuxCare rebuilt 11 packages to address 1 CVE. Fixed in 4.0.18-tuxcare.1...

CLSA-2026-1789477857 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 2.2.6-tuxcare.1...

CLSA-2026-1789473405 TuxCare security update for 23 packages (1 CVE)

TuxCare rebuilt 23 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.4...

CLSA-2026-1789467187 TuxCare security update for 3 packages (1 CVE)

TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 9.20.3-tuxcare.1...

CVE-2026-56830: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-55617: Insufficient Session Expiration

Hydro is a next-generation high-performance online judge platform. From 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store, so an old sid...